@@ -16,6 +16,7 @@ import (
16
16
authorizationapi "github.com/openshift/origin/pkg/authorization/api"
17
17
"github.com/openshift/origin/pkg/authorization/authorizer"
18
18
"github.com/openshift/origin/pkg/client"
19
+ imageapi "github.com/openshift/origin/pkg/image/api"
19
20
oauthapi "github.com/openshift/origin/pkg/oauth/api"
20
21
projectapi "github.com/openshift/origin/pkg/project/api"
21
22
userapi "github.com/openshift/origin/pkg/user/api"
@@ -171,21 +172,21 @@ func (userEvaluator) ResolveRules(scope, namespace string, clusterPolicyGetter c
171
172
switch scope {
172
173
case UserInfo :
173
174
return []authorizationapi.PolicyRule {
174
- {Verbs : sets .NewString ("get" ), APIGroups : []string {userapi .GroupName }, Resources : sets .NewString ("users" ), ResourceNames : sets .NewString ("~" )},
175
+ {Verbs : sets .NewString ("get" ), APIGroups : []string {userapi .GroupName , userapi . LegacyGroupName }, Resources : sets .NewString ("users" ), ResourceNames : sets .NewString ("~" )},
175
176
}, nil
176
177
case UserAccessCheck :
177
178
return []authorizationapi.PolicyRule {
178
- {Verbs : sets .NewString ("create" ), APIGroups : []string {authorizationapi .GroupName }, Resources : sets .NewString ("subjectaccessreviews" , "localsubjectaccessreviews" ), AttributeRestrictions : & authorizationapi.IsPersonalSubjectAccessReview {}},
179
179
authorizationapi .NewRule ("create" ).Groups (kauthorizationapi .GroupName ).Resources ("selfsubjectaccessreviews" ).RuleOrDie (),
180
- authorizationapi .NewRule ("create" ).Groups (authorizationapi .GroupName ).Resources ("selfsubjectrulesreviews" ).RuleOrDie (),
180
+ {Verbs : sets .NewString ("create" ), APIGroups : []string {authorizationapi .GroupName , authorizationapi .LegacyGroupName }, Resources : sets .NewString ("subjectaccessreviews" , "localsubjectaccessreviews" ), AttributeRestrictions : & authorizationapi.IsPersonalSubjectAccessReview {}},
181
+ authorizationapi .NewRule ("create" ).Groups (authorizationapi .GroupName , authorizationapi .LegacyGroupName ).Resources ("selfsubjectrulesreviews" ).RuleOrDie (),
181
182
}, nil
182
183
case UserListScopedProjects :
183
184
return []authorizationapi.PolicyRule {
184
- {Verbs : sets .NewString ("list" , "watch" ), APIGroups : []string {projectapi .GroupName }, Resources : sets .NewString ("projects" )},
185
+ {Verbs : sets .NewString ("list" , "watch" ), APIGroups : []string {projectapi .GroupName , projectapi . LegacyGroupName }, Resources : sets .NewString ("projects" )},
185
186
}, nil
186
187
case UserListAllProjects :
187
188
return []authorizationapi.PolicyRule {
188
- {Verbs : sets .NewString ("list" , "watch" ), APIGroups : []string {projectapi .GroupName }, Resources : sets .NewString ("projects" )},
189
+ {Verbs : sets .NewString ("list" , "watch" ), APIGroups : []string {projectapi .GroupName , projectapi . LegacyGroupName }, Resources : sets .NewString ("projects" )},
189
190
{Verbs : sets .NewString ("get" ), APIGroups : []string {kapi .GroupName }, Resources : sets .NewString ("namespaces" )},
190
191
}, nil
191
192
case UserFull :
@@ -210,10 +211,27 @@ func (userEvaluator) ResolveGettableNamespaces(scope string, clusterPolicyGetter
210
211
// escalatingScopeResources are resources that are considered escalating for scope evaluation
211
212
var escalatingScopeResources = []unversioned.GroupResource {
212
213
{Group : kapi .GroupName , Resource : "secrets" },
213
- /*imageapi.GroupName*/ {Group : "" , Resource : "imagestreams/secrets" },
214
- /*oauthapi.GroupName*/ {Group : "" , Resource : "oauthauthorizetokens" }, {Group : "" , Resource : "oauthaccesstokens" },
215
- /*authorizationapi.GroupName*/ {Group : "" , Resource : "roles" }, {Group : "" , Resource : "rolebindings" },
216
- /*authorizationapi.GroupName*/ {Group : "" , Resource : "clusterroles" }, {Group : "" , Resource : "clusterrolebindings" },
214
+
215
+ {Group : imageapi .GroupName , Resource : "imagestreams/secrets" },
216
+ {Group : imageapi .LegacyGroupName , Resource : "imagestreams/secrets" },
217
+
218
+ {Group : oauthapi .GroupName , Resource : "oauthauthorizetokens" },
219
+ {Group : oauthapi .LegacyGroupName , Resource : "oauthauthorizetokens" },
220
+
221
+ {Group : oauthapi .GroupName , Resource : "oauthaccesstokens" },
222
+ {Group : oauthapi .LegacyGroupName , Resource : "oauthaccesstokens" },
223
+
224
+ {Group : authorizationapi .GroupName , Resource : "roles" },
225
+ {Group : authorizationapi .LegacyGroupName , Resource : "roles" },
226
+
227
+ {Group : authorizationapi .GroupName , Resource : "rolebindings" },
228
+ {Group : authorizationapi .LegacyGroupName , Resource : "rolebindings" },
229
+
230
+ {Group : authorizationapi .GroupName , Resource : "clusterroles" },
231
+ {Group : authorizationapi .LegacyGroupName , Resource : "clusterroles" },
232
+
233
+ {Group : authorizationapi .GroupName , Resource : "clusterrolebindings" },
234
+ {Group : authorizationapi .LegacyGroupName , Resource : "clusterrolebindings" },
217
235
}
218
236
219
237
// role:<clusterrole name>:<namespace to allow the cluster role, * means all>
@@ -318,7 +336,7 @@ func (e clusterRoleEvaluator) resolveRules(scope string, clusterPolicyGetter cli
318
336
}
319
337
role , exists := policy .Roles [roleName ]
320
338
if ! exists {
321
- return nil , kapierrors .NewNotFound (authorizationapi .Resource ("clusterrole" ), roleName )
339
+ return nil , kapierrors .NewNotFound (authorizationapi .LegacyResource ("clusterrole" ), roleName )
322
340
}
323
341
324
342
rules := []authorizationapi.PolicyRule {}
0 commit comments